BurnThisShit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:21 AM UTC
• Version: 2.0.0

Overview

This is an openly destructive session-wipe tool, but it skips normal user confirmation and has path-handling flaws that could delete or corrupt more than intended.

Install only if you deliberately want an irreversible OpenClaw session-erasure tool. Before using it, require an explicit confirmation flow, avoid natural-language auto-triggering, validate the target agent path, and keep separate audit or backup records if recovery or accountability matters.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/burn.sh:14
• Finding: Unvalidated Agent Name Allows Directory Traversal and Destructive Operations Outside the Intended Agent Directory## Vulnerability Details **File Location**: `scripts/burn.sh:14-21` **Vulnerability Type**: Directory traversal and insufficient path-boundary validation **Risk Level**: High ### Vulnerable Code ```bash AGENT="${OPENCLAW_AGENT:-main}" SESSIONS_DIR="$HOME/.openclaw/agents/$AGENT/sessions" # Safety: validate sessions dir structure EXPECTED_PARENT="$HOME/.openclaw/agents" if [[ "$SESSIONS_DIR" != "$EXPECTED_PARENT/"* ]]; then echo -e "${RED}FATAL:${NC} Session dir doesn't match expected parent" exit 1 fi ``` ### Technical Analysis The `OPENCLAW_AGENT` environment variable is incorporated directly into `SESSIONS_DIR` without validation. An attacker can supply an agent name containing path separators and `..` components. The subsequent check is only a lexical prefix comparison. Because `SESSIONS_DIR` is always constructed by prepending `$HOME/.openclaw/agents/`, even a path such as `$HOME/.openclaw/agents/../../../../tmp/target/sessions` satisfies the string-prefix check. The script does not canonicalize the path with `realpath` before enforcing the directory boundary. The later file verification also compares non-canonical path strings and therefore does not correct this weakness. If the traversed destination contains a `sessions` directory and `sessions.json`, the script can find, overwrite, and remove matching files there. ### Attack Path 1. The attacker identifies or creates a writable target directory containing a `sessions` subdirectory. 2. The attacker places a `sessions.json` file and a file matching an accepted session identifier in that directory. 3. The attacker sets `OPENCLAW_AGENT` to a traversal expression resolving to the target, such as a sequence of `../` components followed by the target path. 4. The attacker invokes `burn.sh` with a valid session ID and `--force`. 5. The lexical prefix check succeeds because the unnormalized path still begins with `$HOME/.openclaw/agents/`. 6. The s ...[truncated 543 chars]
• Remediation: ## Remediation Suggestions - Validate `OPENCLAW_AGENT` against a strict allowlist, such as `^[A-Za-z0-9_-]+$`. - Explicitly reject `/`, `\`, `.` and `..` path components. - Canonicalize both the agents directory and selected sessions directory using `realpath`. - Verify that the canonical sessions path is a strict descendant of the canonical agents directory. - Perform the same canonical containment check for every file immediately before destructive operations. - Consider resolving agent names from a trusted configuration rather than accepting an unrestricted environment variable. - Refuse to follow symbolic links in the directory hierarchy where supported.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/burn.sh:220
• Finding: Predictable Temporary File Permits Symlink-Based File Overwrite## Vulnerability Details **File Location**: `scripts/burn.sh:220-234` **Vulnerability Type**: Unsafe temporary-file creation and symlink following **Risk Level**: Medium ### Vulnerable Code ```bash TMP_JSON="${SESSIONS_JSON}.tmp.burn" if jq "$JQ_FILTER" "$SESSIONS_JSON" > "$TMP_JSON" 2>/dev/null; then TMP_KEYS=$(jq 'keys | length' "$TMP_JSON" 2>/dev/null || echo 0) ORIG_KEYS=$(jq 'keys | length' "$SESSIONS_JSON" 2>/dev/null || echo 0) if [ "$TMP_KEYS" -eq 0 ]; then echo " FAIL sessions.json would be empty! Refusing." rm -f "$TMP_JSON" FAILED=$((FAILED + 1)) else mv "$TMP_JSON" "$SESSIONS_JSON" echo " OK sessions.json cleaned (${ORIG_KEYS} -> ${TMP_KEYS} keys)" fi else echo " FAIL sessions.json update failed" rm -f "$TMP_JSON" FAILED=$((FAILED + 1)) fi ``` ### Technical Analysis The temporary output path is fixed and predictable: `sessions.json.tmp.burn`. Shell redirection opens this path without exclusive creation and follows symbolic links. If an attacker can create files in the sessions directory before invocation, they can pre-create the temporary path as a symbolic link to another file writable by the script's user. The redirection truncates the symlink target before `jq` writes its output. The subsequent `rm` or `mv` operations may also produce unexpected filesystem changes. In addition, the temporary file's mode is determined by the current process umask rather than securely inheriting the confidentiality settings of `sessions.json`. Replacing the original file through `mv` can consequently weaken metadata permissions. ### Attack Path 1. The attacker obtains write access to the targeted sessions directory. 2. The attacker creates `sessions.json.tmp.burn` as a symbolic link to another file writable by the account running the script. 3. The attacker invokes or waits for invocation of the burn script for a session ...[truncated 688 chars]
• Remediation: ## Remediation Suggestions - Create the temporary file with `mktemp` inside the already validated sessions directory. - Ensure exclusive creation and reject any pre-existing pathname. - Set restrictive permissions, such as mode `0600`, before writing sensitive metadata. - Verify that the temporary file is a regular file and not a symbolic link. - Preserve the original file's ownership and permission mode where appropriate. - Validate the generated JSON before replacing the original. - Use an atomic rename only after all validation succeeds. - Install cleanup traps to remove the unique temporary file on interruption or failure.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/burn.sh:203
• Finding: Attacker-Controlled JSON Keys Are Interpolated into Dynamically Generated jq Programs## Vulnerability Details **File Location**: `scripts/burn.sh:203-218` **Vulnerability Type**: jq expression injection through unsafe dynamic filter construction **Risk Level**: Medium ### Vulnerable Code ```bash if [ -n "$MATCHING_KEYS" ]; then JQ_FILTER="." while IFS= read -r key; do [ -z "$key" ] && continue ESCAPED_KEY=$(echo "$key" | sed 's/[\\.\\[\\*\\?+^\\$\\(\\)\\{\\}/\\\\]/\\\\&/g') JQ_FILTER="$JQ_FILTER | del(.[\"$ESCAPED_KEY\"])" done <<< "$MATCHING_KEYS" while IFS= read -r key; do [ -z "$key" ] && continue ESCAPED_KEY=$(echo "$key" | sed 's/[\\.\\[\\*\\?+^\\$\\(\\)\\{\\}/\\\\]/\\\\&/g') JQ_FILTER="$JQ_FILTER | (.[\"$ESCAPED_KEY\"].usageFamilySessionIds) |= map(select(. != \"$SESSION_ID\"))" done <<< "$FAMILY_KEYS" ``` ### Technical Analysis Keys read from `sessions.json` are embedded directly into jq source code. The `sed` expression attempts to escape a collection of characters, but it does not safely encode arbitrary strings as jq string literals. In particular, embedded quotation marks and control characters are not robustly handled. Because JSON object keys may contain quotation marks and jq syntax characters, a crafted matching key can terminate the generated string literal and alter the jq filter. Matching keys are attacker-relevant when their associated value contains the selected session ID or when the key ends with `:` followed by that ID. This issue is an injection into the jq transformation language, not direct shell-command injection. The resulting jq expression can perform transformations beyond deleting the intended key, potentially removing or changing unrelated session metadata. ### Attack Path 1. The attacker gains the ability to modify or supply the local `sessions.json`. 2. The attacker inserts a crafted object key containing jq syntax and ensures that it matches th ...[truncated 754 chars]
• Remediation: ## Remediation Suggestions - Do not construct jq source code by concatenating JSON keys. - Pass key collections as data using `--argjson`, or pass individual values using `--arg`. - Use a static jq program that receives the selected session ID and computes deletions internally. - Prefer transformations based on `with_entries`, `delpaths`, or safely constructed path arrays. - Validate that `sessions.json` has the expected object schema before transformation. - Preserve and validate a backup before atomically replacing the original metadata file. - Add tests containing keys with quotes, backslashes, newlines, brackets, jq operators, and Unicode characters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The instruction to 'run the burn script immediately,' 'do not ask redundant questions,' and 'do not explain what you are about to do' promotes silent execution of an irreversible destructive action. Even if the underlying script has some guardrails, suppressing warning and confirmation at the skill layer materially increases the chance of unauthorized or mistaken data destruction.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly allows invocation via vague natural language and instructs the agent to immediately perform destructive deletion of session artifacts. Broad triggers combined with irreversible actions create a high risk of accidental activation, prompt-injection-induced execution, or deletion without clear user intent.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Validates the session ID format (hex + hyphens only)
2. Scans `~/.openclaw/agents/<agent>/sessions/` for files matching that ID
3. Verifies every found file is inside the sessions directory
4. Shreds each file with `shred -n 3 -z -u` (3-pass overwrite + zero-fill)
5. Falls back to `dd if=/dev/urandom` + `rm` if shred unavailable
6. Removes matching entries from `sessions.json`
7. Cleans the session ID from `usageFamilySessionIds` arrays

• Confidence: 91% confidence
• Finding: The documented behavior removes session records from sessions.json and related usageFamilySessionIds arrays, which alters or destroys session persistence metadata in addition to wiping files. In this context, the skill is specifically designed to erase forensic traces, making it dangerous because it can hinder auditability, incident response, and recovery after misuse or compromise.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill promises forensic obliteration of all traces, but the sessions.json cleanup is not guaranteed: it is skipped entirely when no matching keys are detected and explicitly refused when the rewritten file would become empty. That can leave recoverable metadata about the target session behind, creating a mismatch between the advertised behavior and actual destruction guarantees in a highly sensitive deletion tool.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The comments state the script 'NEVER touches memory, skills, config, or any other data' while also saying it removes sessions.json entries. The implementation later rewrites sessions.json in place, so the comment's blanket claim not to touch other data contradicts actual behavior.

Static analysis

No suspicious patterns detected.